CryptoPayment Gateway CVE-2026-81648 leaks wallet keys with no patch

Stores that take cryptocurrency through the CryptoPayment Gateway plugin for WordPress are being probed, and there is no fixed build to install. CVE-2026-81648 scores 10.0. Defused Cyber says it is watching live attempts. Versions 1.2.1 and 1.2.2, and 1.2.2 is the newest release WPScan knows, never check whether the caller is allowed to run an administrative action. Someone who has never logged in can delete files on the server, replace the payment configuration, and read wallet credentials the plugin kept in a readable form.

WordPress closed the plugin in the official directory on August 28, 2026 over a security issue, so a fresh install from the directory should already fail. That does nothing for a site that copied the files in earlier. Public counts put total downloads at 1,845, including 20 in the seven days before the report. How many of those copies are still answering on a live site is unknown. A few hundred checkout pages are a large enough pool for a crew that wants wallet material.

Defused Cyber said the attempts it recorded came from hosts sold as identity-free virtual servers. The sourcing is a footnote. The bug does not need a stolen password. It needs the plugin on a WordPress site the internet can reach.

What the merchant loses

A payment plugin sits next to the money. Wallet credentials stored in the clear are ready to use. Whoever reads them can move funds or pose as the merchant’s payout path. Replacing the gateway configuration can send the next payment somewhere else without a defacement anyone notices at a glance. File deletion is how a noisy intruder breaks the site, or how they clear something they do not want an admin to find.

The National Vulnerability Database entry and WPScan agree on the version range and on the absence of a patch. This desk will not name the action, the request shape, or a way to test it. Owners need the version numbers and the instruction to get the code off the server.

What to do before the next checkout

Remove CryptoPayment Gateway from every WordPress site that still has it. Deactivation leaves the files in place. Delete the plugin, then confirm it is gone from the plugins directory and from any must-use copy a host or a backup job put back.

Rotate every wallet key and payment secret the plugin could see. Do that at the wallet or the processor. A value that still authorizes a transfer is the old secret. Review the gateway settings for a payout destination or a callback you did not choose. Look for missing files and for administrator accounts the staff list does not include.

If the site took payments while 1.2.1 or 1.2.2 was installed and reachable, treat the stored wallet material as exposed. Tell finance. Watch the wallets for transfers the business did not start. A download count in the low thousands is a reason to hurry, because the directory has already pulled the product and the attacks have already started.

This briefing relies on public reporting by The Hacker News and on notes from Defused Cyber, WPScan, and the National Vulnerability Database. It does not include exploit procedures.